Privacy notice

1. Who is responsible

HookOS, Crete, Greece, is responsible for the personal data in HookOS. Contact: hello@hookos.io.

2. Data about you, if you have an account

• Account: your name or business name, your email address, the place where you work, and your password, which is stored only as a secure hash. If you sign in with Google or GitHub, HookOS receives your name and email address from them.
• Your work: the areas you choose, the businesses found for you, your sample sites, your site settings, the domains you connect, the emails you send through HookOS, and the replies they receive.
• Mailbox: the address and app password of the mailbox you connect. The password is stored encrypted and is used only to send and read those emails.
• Billing: your plan, your subscription status and a Stripe customer reference. Your card details go to Stripe and are never stored by HookOS.
• Technical: server logs with your IP address, browser type and the pages you open, used to keep HookOS secure and to fix errors.

3. Data about the businesses in HookOS

HookOS lists local businesses from OpenStreetMap and other public listings and web pages: name, category, address, phone, email, website, social media links and public ratings. Some of these details can identify a person, for example a sole trader. They are used to show account holders which businesses may need a website and to build sample sites for them. The legal basis is legitimate interest in helping local businesses get offered a website. Account holders contact businesses from their own mailboxes and are responsible for those messages.

If your business appears in HookOS and you want its details removed, or you object to their use, write to hello@hookos.io. The details are then removed.

4. Why the data is used

• To provide the service you signed up for (contract).
• To keep HookOS secure and prevent abuse (legitimate interest).
• To keep billing records as tax law requires (legal obligation).

HookOS does not sell personal data, does not show advertising, and does not use analytics or tracking tools.

5. Who receives data

• Hetzner Online hosts the servers.
• Stripe processes payments.
• Anthropic builds sample sites. It receives the business details and your site settings needed for each build.
• TypeSafe, when enabled, receives a business's name and category to skip chain branches before a build.
• Google and GitHub, only if you choose to sign in with them.
• Your email provider, when you connect your mailbox.
• OpenStreetMap services answer area and business searches. OpenFreeMap serves the map, which your browser loads directly. Sample sites can load fonts from Google Fonts.

Some of these providers process data outside the European Economic Area, under their own data protection terms.

6. Cookies and local storage

• hookos_portal keeps you signed in, for up to 30 days.
• hookos_portal_csrf protects your forms, for up to 12 hours.
• hookos-portal-theme in your browser's local storage remembers light or dark mode.

These are needed for the service to work. HookOS sets no analytics or advertising cookies.

7. How long data is kept

Your data is kept while your account is open. When you close your account, its data is deleted from the live system. Copies in private backups remain until those backups are removed. Billing records are kept for as long as tax law requires.

8. Your rights

You can ask for a copy of your data, and ask HookOS to correct it, delete it, limit its use, or send it to you in a portable format. You can object to any use based on legitimate interest. Write to hello@hookos.io. You can also complain to the Hellenic Data Protection Authority at dpa.gr.

9. Security

Connections use HTTPS. Passwords are stored as hashes, mailbox passwords are encrypted, and access to the servers is limited to the operator.

10. Changes

When this notice changes, the new version appears on this page with a new date.